Lucene search
+L

9057 matches found

CVE
CVE
•added 2026/09/10 9:31 p.m.•25 views

CVE-2026-45767

Suricata (network IDS/IPS/NSM engine) versions prior to 7.0.16 and 8.0.5 contain a vulnerability in the datasets feature where the save command's protection against absolute filenames can be bypassed when combined with the load command. A malicious rule could potentially overwrite any file on the...

4.4CVSS5.7AI score0.00398EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist
•added 2026/09/10 9:31 p.m.•37 views

CVE-2026-45767 Suricata datasets: save to absolute filename can be bypassed when combined with load command

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some...

4.4CVSS0.00398EPSS
SaveExploits0References3
OSV
OSV
•added 2026/09/10 5:39 p.m.•8 views

CVE-2026-88054 Tesseract: Denial of service via empty-stack dereference in Plumbing/Series at model load

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks but accepts a zero-length stack for NTSERIES, NTPARALLEL, or NTREVERSED layers in a crafted .traineddata model. During LSTMRecognizer...

6.9CVSS5.8AI score
SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/10 5:39 p.m.•43 views

CVE-2026-88054 Tesseract: Denial of service via empty-stack dereference in Plumbing/Series at model load

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks but accepts a zero-length stack for NTSERIES, NTPARALLEL, or NTREVERSED layers in a crafted .traineddata model. During LSTMRecognizer...

6.9CVSS0.00153EPSS
SaveExploits1References2
Vulnrichment
Vulnrichment
•added 2026/09/10 5:39 p.m.•11 views

CVE-2026-88054 Tesseract: Denial of service via empty-stack dereference in Plumbing/Series at model load

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks but accepts a zero-length stack for NTSERIES, NTPARALLEL, or NTREVERSED layers in a crafted .traineddata model. During LSTMRecognizer...

6.9CVSS5.7AI score0.00153EPSS
SaveExploits1References2
CVE
CVE
•added 2026/09/10 5:38 p.m.•23 views

CVE-2026-88052

Tesseract is an open-source OCR engine. In versions 5.5.3 and earlier , the function UNICHARSET::load_via_fgets (in src/ccutil/unicharset.cpp) uses a declared unichar count as a loop bound and indexes into the unichars vector with an unchecked id. Because unichar_insert_backwards_compatible can l...

7.8CVSS5.9AI score0.00183EPSS
SaveExploits1References2Affected Software1
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/10 12:00 a.m.•1 views

CVE-2026-45767: Improper Limitation of a Pathname to a Restricted Directory

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some...

4.4CVSS5.7AI score0.00398EPSS
SaveExploits0References4
Oracle linux
Oracle linux
•added 2026/09/10 12:00 a.m.•10 views

perl-DBI security update

1.643-9.5 - Use Module::Load for safer package loading in DBI::Profile CVE-2026-19546 Related: RHEL-236831...

8.8CVSS5.8AI score0.00352EPSS
SaveExploits0
Palo Alto Networks
Palo Alto Networks
•added 2026/09/09 4:00 p.m.•9 views

Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File

A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file. Work around: Until a fixed version is deployed, avoid running Checkov over untrusted content, an...

6.3CVSS6AI score0.00189EPSS
SaveExploits1References1
OSV
OSV
•added 2026/09/09 4:04 a.m.•13 views

MAL-2026-16069 Malicious code in reactlogo-load (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0f9d76fcf9f229c0a11508004a2be764133c6195530c4d56563eb28c358ab5f The package presents itself as a logo/color utility but its exported loadLogo function extracts a URL from LSB-encoded bits of a PNG, fetches the...

6AI score
SaveExploits0References1
NVD
NVD
•added 2026/09/08 8:18 p.m.•9 views

CVE-2026-78574

The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the conte...

7.5CVSS0.00099EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/08 8:11 p.m.•13 views

EUVD-2026-74175

The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the conte...

7.5CVSS5.7AI score0.00099EPSS
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
•added 2026/09/08 7:05 p.m.•22 views

Malicious code in punypump (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e56cc14096d20f679823bf15af9f44dff039e01f23d2082eba8020200d04a7f The package presents itself as a console shim index.js is a verbatim copy of console-browserify with description 'Emulate console for all the...

6AI score
SaveExploits0References3
NVD
NVD
•added 2026/09/08 1:17 a.m.•7 views

CVE-2026-58234

SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...

2.2CVSS0.00338EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/09/08 12:10 a.m.•32 views

CVE-2026-58234 Denial of Service vulnerability in SAP Process Integration (SOAP Adapter)

SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...

2.2CVSS0.00338EPSS
SaveExploits0References2
CVE
CVE
•added 2026/09/08 12:10 a.m.•36 views

CVE-2026-58234

SAP Process Integration (SOAP Adapter) is affected by a Denial of Service vulnerability where a privileged user can send specially crafted requests containing deeply nested entity definitions , temporarily increasing processor load and degrading system responsiveness under certain conditions. The...

2.2CVSS5.7AI score0.00338EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•16 views

PT-2026-88430

The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the conte...

7.5CVSS5.7AI score0.00099EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•11 views

PT-2026-87039

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load mon module's stop path where exit and cleanup deletes the LoadMon object and frees the performance counter before perf end attempts to access it. Attackers can trigger this vulnerability by issuing the load mon stop...

7.1CVSS6.2AI score0.00384EPSS
SaveExploits0References6
NVD
NVD
•added 2026/09/07 12:17 p.m.•7 views

CVE-2026-2390

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'contentprocessimages' function using a flawed regex-based HTML attribute parser. This makes it possible for...

6.4CVSS0.00193EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/09/07 11:27 a.m.•8 views

EUVD-2026-72350

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'contentprocessimages' function using a flawed regex-based HTML attribute parser. This makes it possible for...

6.4CVSS5.9AI score0.00193EPSS
SaveExploits0References5
Rows per page
Query Builder